Implementing configurable password policies#7051
Merged
Merged
Conversation
Policies include: - Minimum password length - Password should contain uppercase and/or lowercase characters - Password should contain numbers - Password should contain special characters
Piedone
changed the title
Member
Author
|
@sebastienros @bleroy could you please ask some security expert in Microsoft to validate these changes? |
| } | ||
|
|
||
| [AlwaysAccessible] | ||
| public ActionResult ChangeExpiredPassword(string username) { |
Member
There was a problem hiding this comment.
Do we really need a new way to change the password? Why not use the default action/view? I don't see any real value of testing the validity again here.
Member
Author
There was a problem hiding this comment.
Yes, because if you have to change your password because it expired then you'll get to this screen before logging in. I.e. this password change screen is accessible for anonymous users and the POST method needs to be different. Thus the form's target should be different on this screen, while there is also a hint informing you about your password being expired.
Member
|
Looks good to me security wise. |
Member
Author
|
Thanks. |
| set { this.Store(x => x.EnableCustomPasswordPolicy, value); } | ||
| } | ||
|
|
||
| public bool EnableCustomPasswordLength { |
HermesSbicego-Laser
pushed a commit
to LaserSrl/Orchard
that referenced
this pull request
Jan 12, 2018
* Implementing configurable password policies, see OrchardCMS#5380. Policies include: - Minimum password length - Password should contain uppercase and/or lowercase characters - Password should contain numbers - Password should contain special characters * Adding missing IMembershipSettings and removing now unneeded MembershipSettings * Removing hard-coded password length limits * Removing unnecessary checks when building the model state dictionary * Simplifying password length policy configuration by removing explicit enable option
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Policies include:
See #5380.